CVE-2024-2301

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
HP Inc.Certain HP LaserJet Pro DevicesSee HP Security Bulletin reference for affected versions.

References

Timeline

Published
May 23, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-23025.3The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable toCVE-2024-23036.4The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versionCVE-2024-230316.1Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedCVE-2024-230326.1Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.CVE-2024-230336.1Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.CVE-2024-230346.1Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.CVE-2024-23046.4The Animated Headline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animated-headline' shortcode in alCVE-2024-230499.8An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.CVE-2024-23055.4The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions uCVE-2024-230529.8An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() functCVE-2024-230549.8An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listeCVE-2024-230556.1An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input
CVE-2024-2301: High severity, CVSS 7.6 | Vulnix